Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Quiet privilege drift, weak context, and unmanaged non-human identities are the real drivers of insider risk, according to Veza’s analysis of access governance gaps. The practical lesson is that least privilege fails when entitlement sprawl, toxic combinations, and stale access are allowed to persist without evidence-based review.
NHIMG editorial — based on content published by Veza: Mitigate insider risk by governing access with precision and context
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
Questions worth separating out
Q: How should security teams reduce insider threat risk through access governance?
A: Start with least privilege, then keep proving it through recurring access reviews and automatic revocation when roles change.
Q: Why does privilege creep increase breach impact?
A: Privilege creep enlarges the blast radius of a compromised identity.
Q: What do security teams get wrong about access reviews?
A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check.
Practitioner guidance
- Rebuild reviews around effective permissions Require reviewers to approve or revoke based on actual reachable objects, inherited policy, and app-level grants rather than on directory roles alone.
- Attach business context to every certification item Include owner, data sensitivity, last used date, and downstream reach in the review packet so approvers can make a defensible decision without guessing.
- Identify and remove toxic combinations first Prioritise access paths such as create-and-approve, write-and-exfiltrate, or broad data-store reach before cleaning lower-risk dormant access.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- Access Graph examples showing how identities, roles, policies, and objects are correlated in practice
- Workflow detail for certifications, scoped revocations, and audit evidence capture
- Specific scenarios for compromised employee accounts, vendor offboarding, and service account drift
- Implementation patterns for tying access decisions to downstream reach and data sensitivity
👉 Read Veza's analysis of insider risk, effective permissions, and least privilege →
Insider risk and privilege drift: what access teams need to fix?
Explore further
25/08/2026 6:11 pm
Access drift is the real insider-risk engine, not isolated bad behavior. The article is strongest when it treats privilege creep, offboarding gaps, and inherited cloud access as the underlying condition. That is the same pattern we see across IAM and NHI programmes: access accumulates faster than governance can justify it. Practitioners should treat drift as a control failure, not an exception.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who should own non-human identity governance when service accounts and tokens drift?
A: Ownership should sit with the application or platform team that can explain the business purpose of the credential and act on revocation. Security can set standards and monitor drift, but lifecycle decisions need an accountable owner who can prove why the access still exists and when it should be removed.
👉 Read our full editorial: Insider risk is an access governance problem, not just behavior
